Privacy Policy

CV-Flow ("we", "us") operates the CV-Flow website and application. This Privacy Policy explains what personal data we collect, why we collect it, and the choices you have. For any privacy question, contact us at support@cvflow.net.

• Account data: name, email address, password (hashed), and profile picture if you provide one.
• CV & profile content: work history, education, skills, contact details, and any other information you choose to add to your master CV or profile.
• Job application data: job listings you save or track, application status, notes, and messages generated for outreach.
• Billing data: subscription plan and status. Card and payment details are collected and processed directly by Lemon Squeezy (our Merchant of Record) — we do not store your full card number.
• Usage data: log data such as IP address, browser type, device information, and pages/features used, collected automatically to operate and secure the Service.
• Cookies: see our Cookie Policy for details.

• To provide, maintain, and secure the Service, including authentication and account management;
• To generate AI-optimized CV content and job-matching suggestions based on the information you provide;
• To process subscription payments, trials, and billing through Lemon Squeezy;
• To send transactional emails (e.g. account confirmation, billing receipts, notifications you have enabled);
• To respond to support requests;
• To monitor, debug, and improve the reliability and performance of the Service;
• To comply with legal obligations.

When you use AI-powered features (such as CV optimization or message drafting), the relevant CV content and job description text is sent to our AI provider (OpenAI) to generate a response. This content is processed to deliver the feature you requested and is not used by us to train our own models. Review our Subprocessors page for the current list of providers we share data with.

• Performance of a contract — to provide the Service you signed up for;
• Legitimate interests — to secure, debug, and improve the Service;
• Consent — for optional cookies and marketing communications, which you can withdraw at any time;
• Legal obligation — where processing is required by applicable law.

If you choose to activate a public CV link, the CV content on that page becomes accessible to anyone with the URL, and may be indexed by search engines. This sharing is opt-in and under your control — you can deactivate or delete a public link at any time from your dashboard.

We do not sell your personal data. We share data only with the service providers necessary to operate CV-Flow (hosting, database, AI processing, payments, email delivery), each acting under its own privacy and security obligations, and listed on our Subprocessors page — or where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with notice to you).

Our service providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) offered by those providers for cross-border transfers.

We retain your account and CV data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records (e.g. billing records) for legal or accounting purposes.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your data ("right to be forgotten");
• Export your data in a portable format;
• Object to or restrict certain processing;
• Withdraw consent at any time, without affecting prior lawful processing;
• Lodge a complaint with your local data protection authority.

You can exercise most of these rights directly from your account settings, or by contacting support@cvflow.net. California residents have equivalent rights under the CCPA/CPRA; we do not sell or share personal data as those terms are defined by that law.

We use industry-standard measures to protect your data, including encryption in transit, access controls, and secure infrastructure providers. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Service before they take effect.

Questions about this Privacy Policy? Contact us at support@cvflow.net.